Membership Inference on MS-COCO
99.74ASRCLiDvec
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| CLiDvecQuery=15, Training Setting=Over-training2024.05 | 99.74 | 99.31 | 95.2 | |
| CLiDthQuery=15, Training Setting=Over-training2024.05 | 99.08 | 99.94 | 99.12 | |
| PFAMIQuery=20, Training Setting=Over-training2024.05 | 94.48 | 98.6 | 78 | |
| Naive+FHigh-Frequency Filter=Enabled2025.05 | 93.6 | 98.32 | 41.99 | |
| SecMI+FHigh-Frequency Filter=Enabled2025.05 | 91 | 95.74 | 27.4 | |
| OursBackbone Model=Stable Diffusion v1.5, Knowledge Setting=Partial Knowledge2026.07 | 86 | 95 | 62 | |
| Score-based MIABackbone Model=Stable Diffusion v1.5, Knowledge Setting=Partial Knowledge2026.07 | 85 | 94 | 56 | |
| CLiD-MIABackbone Model=Stable Diffusion v1.5, Knowledge Setting=Partial Knowledge2026.07 | 84 | 95 | 57 | |
| SecMIQuery=12, Training Setting=Over-training2024.05 | 83 | 90.81 | 50.64 | |
| Ours2026.01 | 82.49 | — | — | |
| SecMIHigh-Frequency Filter=Disabled2025.05 | 82.09 | 89.37 | 16.79 | |
| M.C.Query=3, Training Setting=Over-training2024.05 | 82.04 | 89.77 | 36.04 | |
| LossQuery=1, Training Setting=Over-training2024.05 | 81.92 | 89.98 | 32.28 | |
| SecMI2026.01 | 81.7 | — | — | |
| NaiveHigh-Frequency Filter=Disabled2025.05 | 80.29 | 87.85 | 4.8 | |
| unified membership inference frameworkKnowledge Setting=Zero-Knowledge, Base Model=Stable Diffusion v1.5, Embedding Extractor=BLIP2026.07 | 78 | 90 | 45 | |
| PIA+FHigh-Frequency Filter=Enabled2025.05 | 76 | 83.08 | 16.59 | |
| Feature-C2026.01 | 70.04 | — | — | |
| PIAQuery=2, Training Setting=Over-training2024.05 | 68.56 | 75.12 | 5.08 | |
| PIA2026.01 | 68.3 | — | — | |
| PIAHigh-Frequency Filter=Disabled2025.05 | 68.19 | 72.88 | 5.2 | |
| Feature-D2026.01 | 56.31 | — | — | |
| Feature-T2026.01 | 55.2 | — | — | |
| CLiDKnowledge Setting=Zero-Knowledge, Base Model=Stable Diffusion v1.5, Embedding Extractor=BLIP2026.07 | 54 | 48 | 18 | |
| NA-P2026.01 | 52.03 | — | — | |
| GD2026.01 | 51.1 | — | — | |
| ScoreKnowledge Setting=Zero-Knowledge, Base Model=Stable Diffusion v1.5, Embedding Extractor=BLIP2026.07 | 50 | 46 | 15 | |
| Feature-CAttack category=End-to-end attack2026.01 | — | 73.08 | 14.6 | |
| Feature-DAttack category=End-to-end attack2026.01 | — | 58 | 3 | |
| Feature-TAttack category=End-to-end attack2026.01 | — | 57.7 | 3.2 | |
| GDAttack category=End-to-end attack2026.01 | — | 51.22 | 1 | |
| NA-PAttack category=End-to-end attack2026.01 | — | 52.41 | 2.2 | |
| Noise as a ProbeAttack category=End-to-end attack2026.01 | — | 90.46 | 21.8 | |
| PIAAttack category=Intermediate result attack2026.01 | — | 71.38 | 5.2 | |
| SecMIAttack category=Intermediate result attack2026.01 | — | 89.37 | 16.79 |